Quantum Secure Communication via W States 
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W states of multipartite systems are pair-wisely entangled, belonging to a different class from 
Greenberger, Home, and Zeilinger states. Based on W states, we propose three variant protocols for 
quantum secure communication, i.e., quantum key distribution, partial quantum secret sharing, and 
their synthesis. By the synthesis we mean that both quantum key distribution and partial quantum 
secret sharing are executed in a single protocol. For these protocols it is discussed how authorized 
communicators detect individual attacks by an eavesdropper. 

PACS numbers: 03.67.-a, 03.67.Dd 



I. INTRODUCTION 

Quantum entanglement is at the heart of quantum 
information processes. In particular bipartite entangle- 
ment has been extensively studied for quantum key dis- 
tribution jlj, teleportation entanglement swapping 
||, entanglement teleportation conclusive teleporta- 
tion and quantum computation ||. On the other 
hand multipartite entanglement has been relatively less 
studied in terms of information-theoretic aspects. 

Recently the classification on the states of three qubits 
has been proposed [@, f| §]■ A typical class includes 
Greenberger- Home- Zeilinger (GHZ) states which exhibit 
nonlocality among distant local observables jlO) and have 
nonvanishing tangle W states are pair- wisely en- 

tangled with no tangle and they belong to the differ- 
ent class from GHZ states in the sense that they can 
not be transformed to any GHZ states under the lo- 
cal operation and classical communication (LOCC) [ fL2| . 
These facts suggest that W states have the physical 
properties considerably different from GHZ states. W 
states have been rarely considered for quantum informa- 
tion protocols, whereas GHZ states have been employed 
for quantum cryptography among several distant parts 
|| @|. 

The nonlocality of W states were studied by explicitly 
considering non-commuting observables ]lq ]. The gener- 
ation of W states has been investigated with the physical 
models based on linear optical elements JlTj , cavity QED 
Hi, and Heisenberg XY model (!§]. 

In this paper we propose three variant protocols by 
using W states of three qubits which enable the quan- 
tum secure communication among three distant persons. 
The protocols include quantum key distribution (QKD) 
in the pair-wise way and partial quantum secret sharing 
(PQSS) among the three persons. In addition we propose 



a synthesis protocol by which both pair-wise QKD and 
PQSS are executed simultaneously when it is necessary. 
It is discussed how authorized communicators detect in- 
dividual attacks by an eavesdropper. 



II. CHARACTERISTICS OF W STATES 

We consider briefly the known characteristics on W 
states of three qubits and compare them with those of 
GHZ states. W states can not be transformed to the GHZ 
state under LOCC, implying they belong to a different 
class from the GHZ states jl2| . 

A pure triseparable state of three qubits is defined by 
Schmidt-like decomposition as |M 



(1) 
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where {|ai)}, {|/J;)} and {|7i)} are orthonormal basis 
sets on the Hilbert spaces for the three qubits, respec- 
tively, and Xi are positive. The triseparability is closely 
related to the tangle r = 2AiA 2 (ll). When \. t = 1/V%, 
the triseparable state (Q) becomes a maximal GHZ state 
with r = 1. When the partial trace is performed over one 
qubit, the reduced density operator of the other qubits 
can be represented by a convex sum of product states. 
It implies that the reduced density operator is separa- 
ble. On the other hand, it can be shown by generalized 
Schmidt decomposition scheme || that W states are not 
triseparable since they can not be represented in the form 
of Eq. (Q). Thus W states have no tangle, r = 0. But 
the reduced density operator for each pair among the 
three qubits is inseparable because its partial transposi- 
tion has at least one negative eigenvalue. Thus, the W 
state is pair-wisely entangled with no tangle. 

The nonlocality of W states can be revealed by three 
local observers. Let z q and x q be the outcomes (+ or 
— ) in measuring & z and & x on qubit q (q = A,B,C). 
For the W state the local observables z q and x q satisfy 
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Einstein-Podolsky-Rosen (EPR) criterion of elements of 
reality and should be predetermined before any measure- 
ment pT| . However, such a predetermination is impossi- 
ble according to quantum mechanics. Recently, Cabello 
JT(| has shown that quantum mechanics refutes EPR's 
elements of reality by the proof similar to the GHZ's. It 
is notable that the refutation results from the inferences 
by only two of three qubits while the inferences by all 
three qubits are necessary for GHZ's. 

Bell's theorem for W states of three qubits can be in- 
vestigated also by considering Clauser-Horne-Bell (CH- 
Bell) inequality 



-1 < A n - A 12 - A 21 - A 22 < 0, 



(2) 



where An = P(z l — z+, z° = z + ) is the probability that 
two qubits i and j among the three raise the outcomes 
of z + as they are measured by & z , and A\2 — P{z l — 
z + , x 3 7^ x k ) is the probability that one qubit i measured 
by <t 2 raises the outcome of z+ and the others j and k 
measured in a x raise the outcomes opposite to each other. 



Similarly, A 2 \ = P(x l ^ x k 



z + ), and A 22 = P(x l 



In particular consider a symmetric W state pi, 

I WO = -j= {\z-z+z+) + \z+z-z+) + \z + z+z^)) , (3) 

where \z~)} is the set of the eigen states for a z and 

the symbol "(g)" for the direct product is omitted unless 
any confusions arise. For this symmetric W state ([|), 



P(z l = z + ,z ] =z+) = 1 

P(z l = z+,x j ^x k ) = 

P{x i ^x k ,z i =z+) = 
P{x l = x 3 = x k ) 



3/4. 



(4) 
(5) 
(6) 
(7) 



The middle term in Eq. 
of the CH-Bell inequality 



is 1/4, implying the violation 



III. QUANTUM SECURE COMMUNICATION 
VIA W STATES 



A. Pair-wise quantum key distribution 

Quantum key distribution (QKD) is a secure commu- 
nication scheme by which two distant persons have in 
common a secret key message via quantum channels and 
classical communication. A QKD protocol includes three 
basic steps: a) Encoding a key message on a quantum 
state, b) transmitting the quantum system in the en- 
coded state, and c) decoding the key message from the 
state. Protocols for QKD may be divided into two sets: 
protocols assisted by an entangled quantum channel and 
the rest of protocols. The protocol suggested by Ekert 
(E91) |] and that by Bennett and Brassard (BB84) [§| 
are representative of the two sets respectively. 



TABLE I: Deciders and mutual relations among the outcomes 
in local measurements for pair- wise quantum key distribution 



Alice 


Bob 


Charlie 


decider 


z+ 


x+ 


x+ 


Alice 


Z_l_ 


X— 


x 




Z- 


x+ or X- 


x+ or X- 




X + 


z+ 


x + 


Bob 


X- 


z+ 


X- 




x+ or X- 


Z- 


x+ or X- 




x+ 


X+ 


z+ 


Charlie 


X- 


X- 


z+ 




x+ or X- 


x + or X- 


Z- 





In BB84, a sender encodes a key message on non- 
orthogonal states of a quantum system (e.g., photon po- 
larization) which is directly transferred to an authorized 
person, a receiver. The receiver can retrieve the key mes- 
sage by a measurement on the state if the measurement 
is approved through classical communication with the 
sender. Security of BB84 has been investigated based 
on no cloning theorem |22|, . Modified protocols have 
been proposed p4[ . 

On the other hand, E91 utilizes an entangled EPR 
pair as a quantum channel. Two distant persons share 
an EPR pair. Each person measures an observable ran- 
domly chosen among three non-commuting observables. 
By doing so, the two persons can have in common a 
key message if both measurements are approved through 
classical communication. The procedures for encoding 
and decoding are executed at the same time, contrary to 
BB84. Security of E91 is based on Bell's theorem f||. As 
the quantum channel is in an EPR state, the authorized 
persons can see a violation of Bell's inequality from mea- 
surement outcomes. Provided an eavesdropper enforces 
an intercept-resend strategy to extract the key message 
pr| , the attempt breaks the entanglement of the quan- 
tum channel and thus the Bell's inequality is not violated. 
The link between security of QKD and Bell's inequality 
has been intensively discussed against individual attacks 
by an eavesdropper ]T^ |. 

Bennett el al. |27| suggested a slightly variant protocol 
(BBM92) from E91 with a simplified set of observables 
and showed that BBM92 is actually equivalent to BB84 
although they have different characteristics on quantum 
channels. They investigated the security by comparing 
a priori probabilities with posteriori ones of outcomes 
instead of Bell's inequality. 

We propose a pair-wise QKD protocol via W states of 
three qubits, which is similar to BBM92 using EPR state 
of two qubits. Suppose that three authorized persons, 
Alice, Bob, and Charlie, would like to perform a secure 
communication in the pair-wise way such that every pair 
among the three persons tries to have a key message and 
in particular the members in the pair have in common 
the key message. 

Consider a composite system of three qubits which is 
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in a symmetric W state in Eq. (||) . The three authorized 
persons share the three qubits, one qubit for each per- 
son. As in E91 or BBM92 they acquire key messages by 
performing local measurements. Each person randomly 
chooses an observable out of <j z and a x . After his mea- 
surement, he announces the axis but not the outcome. 
When Alice measures along d\ axis, Bob along da, and 
Charlie along d 3 , the set of the axes is denoted by d\-d2- 
d 3 . We employ particular sets of 

and z-x-x for the present pair- wise QKD. The probability 
to choose one of the sets is 3/8. 

In Table |, we present mutual relations among out- 
comes when the authorized persons perform local mea- 
surements along a particular set of axes. One who mea- 
sured along z-axis decides whether it is possible for the 
others to have in common a key message. We call him 
a decider. For example, consider the case of x-x-z. If 
Charlie obtains an outcome z_ in his local measurement 
along the z-axis, then Alice and Bob have their pair in 
the product state |z+z + ) and futher they obtain out- 
comes randomly out of x + and x_ in their local mea- 
surements along the x-axis. The outcomes are useless 
for the present protocol and discarded as they exhibit no 
correlation. However, if Charlie obtains z + , the pair that 
Alice and Bob share comes to be in the maximally entan- 
gled state (|z_z + ) + \z + z-})/^/2. In the measurements 
along x-axis, Alice and Bob obtain the same outcome of 
x+ or X-. They may now regard the outcome as a key 
bit. Similar procedures are applied to the rest of x-z-x 
and z-x-x. The success probability in distributing a key 
bit is 2/3 once a particular set of measurement axes is 
chosen among x-x-z, x-z-x, and z-x-x. 

The present pair-wise QKD protocol via W states is 
summarized as following 

K.l Each of Alice, Bob, and Charlie chooses, at ran- 
dom, the axis of measuring instrument out of x- 
and z-axes. 

K.2 Each person announces a bit information on the 
axis of his local measurement but not the outcome. 

K.3 For the purpose of security one requests to an- 
nounce their outcomes at random in the trials of 
distributing key messages. 

K.4a All keep their outcomes if the set of the measure- 
ment axes is x-x-z, x-z-x, or z-x-x. Otherwise 
restart the protocol. 

K.4b A decider who measured along z-axis tells the rest 
to regard their outcomes as a key bit if his outcome 
is z_|_. Otherwise restart the protocol. 

K.5 Repeat the protocol until they have key bits as 
many as they want. 

K.6 By obtaining frequencies of security-check events 
over the outcomes which were announced at the 
step K.3, verify the security of quantum channel 
against attacks by an eavesdropper (See Sec. IV 



for details). If the errors are larger than permitted, 
throw away the key bits which have been obtained 
so far. 

Overall success probability P s in obtaining a key bit is 
given by multiplying together the probability of choos- 
ing a particular set of measurement axes and the success 
probability of distributing a key bit for a given particu- 
lar set of axes. The number of distributed key bits K t is 
given as 



K f = P S N„ 



(8) 



where P s is an overall success probability and N e an ef- 
fective number of trials. In the pair- wise QKD P s = 1/4 
and N e = N — M where N is a number of total trials in 
the protocol and M a number of trials for the purpose of 
security. For a given K t , the protocol requires n q qubits 
such that 



3K t 



P s (l + M/N)' 



(9) 



In the limit of N -> oo, M/N — > and n q -> 3K t /P s . 
Thus the protocol requires 12 qubits per a key bit at 
average. On the other hand, the protocol of E91 has the 
overall success probability P s = 2/9 and it requires 9 
qubits per a key bit. 



B. Partial quantum secret sharing 

Quantum secret sharing is a key distribution protocol 
among N persons in such a way that one's key message 
can be retrieved by the others only if they cooperate all 
together. Variant protocols have been proposed by using 
multipartite GHZ states U3, fL5[ and bipartite EPR states 



Here we consider a partial quantum secret sharing pro- 
tocol (PQSS) using W states of three qubits. The pro- 
cedure for PQSS among three persons is similar to the 
pair- wise QKD. The difference is the set of measurement 
axes, i.e., z-z-z is employed. 

Suppose Alice, Bob, and Charlie would like to perform 
QSS by sharing three qubits in a symmetric W state (||). 
Each person randomly chooses an observable out of a z 
and a x as done in the pair- wise QKD. After his measure- 
ment, he announces the axis but not the outcome. In 
the case of z-z-z, he may regard the outcome as a key 
bit. More explicitly, consider a case that Bob and Char- 
lie are expected to retrieve Alice's key message in their 
cooperation. If Alice has the outcome z + , then Bob and 
Charlie have opposite outcomes out of z+ and z_. Oth- 
erwise Both have the same outcome z + . When Bob and 
Charlie cooperate so as to collect their outcomes, they 
can correctly deduct Alice's key bit. We note that, if 
Bob or Charlie obtains z_ , he will realize that the other 
and Alice have the same outcome z+. In the case he can 
deduct Alice's key bit without help of the other. It will 
be done in the probability of 1/3. The fact implies that 
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Bob and Charlie may have partial information on Alice's 
key bit. However, Bob and Charlie must still cooperate 
to retrieve completely Alice's key bits. In the sense we 
call the present protocol a PQSS. 

Although the actual key sharing is performed in the 
case of z-z-z, the authorized persons must choose a x for 
their observables as well for the purpose of security. If 
they chose only z-axis for PQSS, an eavesdropper could 
extract all information by measuring along z-axis. 

The protocol of PQSS has steps in common with the 
pair-wise QKD protocol: Most steps in the pair-wise 
QKD protocol are applicable to PQSS but the step K.4 
is modified as 

S.4 All keep their outcomes if the set of the measure- 
ment axes is z-z-z. Otherwise restart the protocol. 

In PQSS we have the overall success probability P s = 
1 /8 which is determined by the probability of choosing 
z-z-z. Due to the arguments below Eq. (||), 24 qubits 
are necessary to share a key bit at average in the limit 
of N -> oo. On the other hand, HBB99 with P s = 1/2 
needs 6 qubits per a key bit. 



C. Synthesis of QKD and PQSS 

The proposed protocols for QKD and PQSS via W 
states overlap the following procedures, a) performing 
local measurements for an observable out of a z and a x 
at random and b) checking security by obtaining frequen- 
cies in security-check events. They differ in choosing a set 
of measurement axes and their sets of axes are mutually 
exclusive. This observation enables a synthesis protocol 
by which both QKD and PQSS are performed simulta- 
neously. That is, if authorized persons choose a set of 
axes out of x-x-z, x-z-x, and z-x-x, their outcomes are 
used for QKD and, if they choose z-z-z, their outcomes 
are used for PQSS. We construct the synthesis protocol 
by inserting a new step B.3' between K.3 and K.4 in the 
protocol of pair-wise QKD as 

B.3' If the set of the measurement axes is z-z-z, go to 
the step S.4 and otherwise go to K.4. 

In the synthesis protocol, the probability to perform 
QKD is not equal to that for PQSS. Of successful trials 
for QKD or PQSS, 2/3 and 1/3 are involved in QKD and 
PQSS respectively. The overall success probability for 
the synthesis protocol is obtained by summing those for 
QKD and PQSS so that P s =3/8. Due to the arguments 
below Eq. (0), in the limit of N — > oo, the necessary 
number of qubits is n syn = 8 per a key bit at average. In 
order to compare the synthesis protocol, let us consider a 
separate protocol performed by E91 for QKD and HBB99 
for QSS in probabilities 2/3 and 1/3 respectively. The 
necessary number of qubits is n^ ep = 8, which is equal to 
n s q yn . 



IV. SECURITY IN THE PROPOSED 
PROTOCOLS 

How is it guaranteed that the distributed key messages 
are secure against attacks by an eavesdropper? An eaves- 
dropper, Eve, may have several kinds of strategies to at- 
tack p6| . A systematic method for security is not known 
against all possible strategies. We shall consider simple 
individual attacks such that Eve performs a unitary op- 
eration on a composite system of her auxiliary qubit and 
one of three qubits, which are involved in a secure com- 
munciation, and she tries to extract some information 
by measuring her auxiliary qubit [fl5[ |26| , p7f . We show 
that authorized persons can detect these attacks as they 
examine frequencies of their outcomes. 

Suppose Eve tries to extract some information from a 
qubit for Charlie. Preparing her qubit in the state \z+) 
for a simplicity and intercepting the qubit on the way for 
Charlie, Eve applies to the composite system of her and 
Charlie's qubit a unitary operation of 

Uce\z+z + ) C e = \z+z + ) C E 

Uce\z-z + ) C e = cos 4>\z-z + ) C e + sin (j)\z + z^) c £10) 

where 4> € [0, n/2] characterizes the strength of Eve's at- 
tack. This unitary operation was considered to study the 
optimal individual attack by Eve |30| . Due to eavesdrop- 
ping, the four-qubit state of A, B, C, and E reads 

\W') = -^=(\z-z + z + z + ) + \z + z-z + z + ) 

+ cos(f>\z + z + z-z + ) + sin0|z + z + z + z_)).(ll) 

This state is no longer symmetric. The probabilities 
given in Eqs. (|j) to (Q) come to vary with respect to 
the observing persons. In particular P(z c = z + ,x A ^ 
x B ) £ P(z A = z+, x B ^ x c ) in Eq. (§). 

It is clear that the trial of Eve's eavesdropping changes 
not only the state of quantum channel but also its proba- 
bilities in Eqs. (^) to (0). For example, consider the event 
that one person has the outcome Zi — z + and the others 
have the opposite outcomes Xj ^ Xk once the authorized 
persons choose one of and z-x-x for their 

measurement axes. The probability of such an event to 
occur vanishes as given in Eq. (§ if there is no eaves- 
dropping. However, as Eve tries the individual attack, 
the probabilty of such an event becomes (1 — cos 2 <fi)/G if 
Charlie chooses z-axis and (1 — cos <ft) /3 if he does x-axis. 
This implies that such an event is expected to occur in 
the probability 

(1 -cos(ft)(5 + cos<ft) 

18 { 1 

which is obtained by averaging the probabilities over 
Charlie's two cases. Keeping it in mind that such an 
event never happens if there is no attack by Eve, the 
authorized persons can detect Eve's eavesdropping by 
checking whether such an event occurs. We call, by 
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a security-check event, an event which can be used to 
detect Eve's eavesdropping. For the security of QKD, 
PQSS, and the synthesis, we employ the event that one 
person has the outcome z% — z + and the others have the 
opposite outcomes Xj ^ Xk- This security event has an 
advantage over others such that they never occur if no at- 
tack by Eve and their occurrence indicates directly Eve's 
attack. 

Subensemble of local-measurement outcomes suffices 
to examine the security of the proposed protocols. One 
of three persons may request at random to announce their 
outcomes by M times among N trials for distributing key 
messages. We call M a number of security trials. Based 
on M sets of outcomes, they obtain the frequency of the 
security-check event and verify whether there is an attack 
by Eve. This procedure is appended to the protocols as 
steps K.3 and K.6. 



V. REMARKS 

We have proposed three variant protocols of quantum 
key distribution, partial quantum secret sharing, and 



their synthesis based on W states, which have the differ- 
ent nonlocal characteristics from GHZ states. We have 
shown that these protocols are secure against the simple 
individual attacks by an eavesdropper. 



Acknowledgments 



This work has been supported by the BK21 Project 
No. D-1099 of the Korea Ministry of Education. J. L. 
has been supported in part by the Korean Ministry of 
Science and Technology through the Creative Research 
Initiatives Program under Contract No. 00-C-CF01-C- 
35 and by the Post-doctoral Fellowship Program of Korea 
Science & Engineering Foundation (KOSEF) 



A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). 

C. H. Bennett, G. Brassard, C. Crepeau, R. Jozsa, A. [15] 
Peres, and W. K. Wootters,Phys. Rev. Lett. 70, 1895 
(1993). 

M. Zukowski, A. Zeilinger, M. A. Home, and A. Ek- [16] 
ert, Phys. Rev. Lett. 71, 4287 (1993); J.-W. Pan, D. [17] 
Bouwmeester, H. Weinfurter, and A. Zeilinger, Phys. 
Rev. Lett. 80, 3891 (1998). 

J. Lee and M. S. Kim, Phys. Rev. Lett. 84, 4236 (2000). [18] 
M. Horodecki, P. Horodecki, and R. Horodecki, Phys. 
Rev. A 60, 1888 (1999); W. Son, J. Lee, M.S. Kim, and [19] 
Y.-J. Park, Phys. Rev. A 64, 064304 (2001). [20] 
M. A. Neilsen and I. L. Chuang, Quantum Computation 
and Quantum Information (Cambridge Press, UK, 2000). [21] 
W. Diir, J. I. Cirac, and R. Tarrach, Phys. Rev. Lett. 83, 
3562 (1999). 

A. Acin, A. Andrianov, L. Costa, E. Jane, J. I. Latorre, [22] 
and R. Tarrach, Phys. Rev. Lett. 85, 1560 (2000). 
A. Acin, D. Bru/3, M. Lewenstein, and A. Sanpera, Phys. 
Rev. Lett. 87, 040401 (2001). 

D. M. Greenberger, M. A. Home, and A. Zeilinger, Bell's I 23 ] 
Theorem, Quantum Theory, and Conceptions of the Uni- 
verse, edited by M. Kafatos (Kluwer, Dordrecht, 1989), I 24 ] 
p. 69; D. M. Greenberger, M. A. Home, and A. Zeilinger, 

Am. J. Phys. 58, 1131 (1990). 

V.Coffman, J. Kundu, and W. K. Wootters, Phys. Rev. 
A 61, 052306 (2000). I 25 ] 
W. Diir, G. Vidal, and J. I. Cirac, Phys. Rev. A 62, 
062314 (2000). 

M. Hillery, V. Buzek, and A. Berthiaume, Phys. Rev. A I 26 ] 
59, 1829 (1999). 

J. Kempe, Phys. Rev. A 60, 910 (1999); R. Cleve, D. I 2 ?] 

Gottesman, and H. Lo, Phys. Rev. Lett. 83, 648 (1999); 

G. A. Dukin, C. Simon, and D. Bouwmeester, Phys. Rev. [ 2 8] 



Lett. 88, 187902 (2002). 

V. Scarani and N. Gisin, Phys. Rev. Lett. 87, 117901 

(2001) ; Phys. Rev. A 65, 012311 (2001) and references 
therein. 

A. Cabello, Phys. Rev. A 65, 032108 (2002). 
A. Zeilinger, M. A. Home, and D. M. Greenberger, NASA 
Conf. Publ. No. 3135 (National Aeronautics and Space 
Administration, Code NTT, Washington DC, 1997). 
G. Guo, C. Li, J. Li and G.Guo, Phys. Rev. A 65, 042102 

(2002) . 

X. Wang, Phys. Rev. A 64, 012313 (2001). 

A. V. Thapliyal, Phys. Rev. A 59, 3336 (1999); J. Eisert 

and H. J. Briegel, Phys. Rev. A 64, 022306 (2001). 

A. Einstein, B. Podolsky, and N. Rosen, Phys. Rev. 47, 

777 (1935); D. Bohm, Quantum Theory (Prentice Hall, 

Englewood Cliffs, NJ, 1951). 

C. H. Bennett and G. Brassard, in Proceedings of IEEE 
International Conference on Computers, Systems, and 
Signal Processing, Bangalore, India (IEEE, New York, 
1984). 

P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 
(2000) and references therein. 

C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and 
J. Smolin, J. Crypt. 5, 3 (1992); G. Gilbert and M. Mam- 
rick, e-print |quant-ph/01060"3l (2001); W. Y. Hwang, I. 
G. Koh, and Y. D. Han, Phy. Lett. A 244, 489 (1998). 
J. S. Bell, Physics (Long Island City, NY.) 1, 195 (1965); 
J. F. Clauser, M. A. Home, A. Shimony, and R. A. Holt, 
Phys. Rev. Lett. 23, 880 (1969). 

N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. 
Mod. Phys. 74, 145 (2002). 

C. Bennett, G. Brassard, and N. D. Mermin, Phys. Rev. 
Lett. 68, 557 (1992). 

A. Karlsson, M. Koashi, N. Imoto, Phys. Rev. A 59, 162 



6 



(1999). [30] C.-S. Niu and R. B. Griffiths, Phys. Rev. A 60, 2764 

[29] W. Tittel, H. Zbinden, and Gisin, Phys. Rev. A 63, (1999). 
042301 (2001). 



